It is crucial to many products using firmware in a controller or processor to assure its authenticity to provide reliable and consistent device functioning in a tamper-resistant manner. While numerous security protocols exist in the public domain for securing data transmissions, none exist for embedded computer systems having limited hardware support, in turn, driven by low-cost targets. In other words, modern controllers (whether wholly integrated in ASIC form or spread amongst numerous chips on a circuit board, for example) are engineered to be more inexpensive with each generation. For example, sophisticated controllers with on-board or integral read-only memories (ROMs), where firmware is often stored, are now being made with field-programmable, non-volatile memories to increase flexibility and allow upgrade of the device after it is sold. This, however, comes at the cost of having assuredly authentic firmware that must come from another source, such as from a download external to the device or from non-integral, non-volatile memory subject to tampering attacks. Also, many computing devices upon learning of untrustworthy firmware render inoperative the entire functionality of the computing device thereby leaving users with a device unable to perform in the role for which it was purchased.
To the extent an embedded system includes numerous input/output ports or varied memory configurations, especially an embedded system using a demand paging operating system to minimize random access memory (RAM) requirements, making sure that a set of firmware that was earlier signed or verified is still the set of code executing, is especially troubling. Making sure that an alternate set of firmware has not been substituted between the time when the authentic firmware is verified and when the code is “paged in” presents numerous issues.
Accordingly, a need exists in the art of computing devices with embedded systems, such as laser printers, to be able to authenticate controller firmware despite engineering and financial constraints forcing limited hardware support. The need further contemplates assisting users in troubleshooting their devices, despite firmware being recognized as untrustworthy and to ensure ongoing authentication exists for times after initial authentication. In this manner, users can have fully operational and authenticated devices at all times. Naturally, any improvements along such lines should further contemplate good engineering practices, such as relative inexpensiveness, stability, ease of implementation, low complexity, security, unobtrusiveness, etc.